@nifrajs/web 4.0.2 → 5.1.0

package/src/internal/secret-scan.ts

@@ -148,11 +148,12 @@ const JWT = /\beyJ[A-Za-z0-9_-]{8,}\.(eyJ[A-Za-z0-9_-]{8,})\.[A-Za-z0-9_-]{16,}/
 const PLACEHOLDER =
   /^(?:user(?:name)?|pass(?:word)?|pwd|secret|admin|root|guest|test|demo|example|changeme|change-me|xxx+|\*+|\.\.\.+|my-?password|your-?password|<[^>]*>|\$\{[^}]*\}|\{\{[^}]*\}\}|%[A-Za-z_]+%?)$/i
 
-/** A literal assigned to a name: `apiKey: "..."`, `const secret = '...'`. Template literals with an
- * interpolation are not literals. The lookbehind starts a name only where an identifier starts: a
- * match from inside a long word run backtracks the rest of that run, quadratic in its length. */
+/** A literal assigned to a name: `apiKey: "..."`, `const secret = '...'`, `"x-api-key": "..."`.
+ * Template literals with an interpolation are not literals. The lookbehind starts a name only where
+ * an identifier starts: a match from inside a long word run backtracks the rest of that run,
+ * quadratic in its length. A hyphenated name starts only right after a quote, for the same reason. */
 const ASSIGNED =
-  /(?<![\w$])([A-Za-z_$][\w$]*)(["']?)\s*([:=]|\?\?=|\|\|=)\s*(?:"([^"\\\r\n]{16,256})"|'([^'\\\r\n]{16,256})'|`([^`\\$\r\n]{16,256})`)/g
+  /(?<![\w$])((?<=["'])[A-Za-z_$][\w$-]*(?=["'])|[A-Za-z_$][\w$]*)(["']?)\s*([:=]|\?\?=|\|\|=)\s*(?:"([^"\\\r\n]{16,256})"|'([^'\\\r\n]{16,256})'|`([^`\\$\r\n]{16,256})`)/g
 
 /** Whether a match's name is what the literal is assigned to. A quoted name must be the whole string,
  * not the tail of one (`? "new-password" : "current-password"`), and a key is never preceded by a
@@ -168,9 +169,33 @@ function namesTheTarget(text: string, start: number, quote: string, operator: st
   return text[before] !== "?" && text[before] !== "."
 }
 
+/** A quoted name and a literal written as a pair: `headers.set("x-api-key", "...")`,
+ * `new Headers([["x-api-key", "..."]])`. The last group is what follows the literal. */
+const PAIRED =
+  /(["'])([A-Za-z_$][\w$-]*)\1\s*,\s*(?:"([^"\\\r\n]{16,256})"|'([^'\\\r\n]{16,256})'|`([^`\\$\r\n]{16,256})`)\s*([\]),]?)/g
+
+/** A value spelled as words or as a constant's name: another field (`["password",
+ * "passwordConfirmation"]`), an environment variable, a stand-in token (`"Bearer not-a-token"`). */
+const NAME_LIKE =
+  /^(?:[A-Za-z][a-z]*(?:[A-Z][a-z]+|[_.-][A-Za-z][a-z]*)+|[A-Z][A-Z0-9]*(?:_[A-Z][A-Z0-9]*)+)$/
+
+/** Whether a pair is a whole two-element array, or the first two arguments of `.set(` or `.append(`:
+ * an element in a longer list is not a pair. */
+function opensAPair(text: string, quoteAt: number, after: string): boolean {
+  let before = quoteAt - 1
+  while (before >= 0 && /\s/.test(text[before] ?? "")) before--
+  if (text[before] === "[") return after === "]"
+  if (text[before] !== "(" || (after !== ")" && after !== ",")) return false
+  return /\.(?:set|append)$/.test(text.slice(Math.max(0, before - 7), before))
+}
+
 const EXTRA_SECRET_NAME =
   /(?:accesskey|signingkey|encryptionkey|masterkey|serviceaccountkey|connectionstring)$/
 
+/** Header names whose value puts a scheme before the credential: `"Bearer <token>"`. */
+const AUTHORIZATION_NAME = /^(?:proxy)?authorization$/
+const AUTHORIZATION_VALUE = /^(?:(bearer)|basic) +(\S+)$/i
+
 /** Values that look like keys but are public by design. */
 const PUBLIC_VALUE =
   /^(?:AIza[0-9A-Za-z_-]{35}|pk_(?:live|test)_[0-9A-Za-z]+|6L[0-9A-Za-z_-]{38}|G-[A-Z0-9]{6,}|UA-\d+-\d+)$/
@@ -200,6 +225,32 @@ function looksRandom(value: string, minLength: number): boolean {
   return classes >= 2 && entropy(value) >= 3.5
 }
 
+/** A password the scanned text spells as a placeholder or a dev default. */
+function placeholderPassword(user: string, password: string): boolean {
+  // nifra-expect NF-S002: a password equal to its user name is a placeholder in the text being
+  // scanned; nothing is authenticated here.
+  return PLACEHOLDER.test(password) || password === user || /[${}<>*]/.test(password)
+}
+
+/** The credential an `Authorization` literal carries: a Bearer token, or a Basic `user:password`
+ * that is not a placeholder. */
+function authorizationCredential(value: string): string | undefined {
+  const found = AUTHORIZATION_VALUE.exec(value)
+  if (found === null) return undefined
+  const credential = found[2] ?? ""
+  if (found[1] !== undefined) return NAME_LIKE.test(credential) ? undefined : credential
+  let decoded: string
+  try {
+    decoded = atob(credential)
+  } catch {
+    return undefined
+  }
+  const colon = decoded.indexOf(":")
+  if (colon === -1 || placeholderPassword(decoded.slice(0, colon), decoded.slice(colon + 1)))
+    return undefined
+  return credential
+}
+
 function jwtRole(payload: string): unknown {
   try {
     const json = atob(payload.replaceAll("-", "+").replaceAll("_", "/"))
@@ -231,11 +282,7 @@ function formatMatches(text: string): Match[] {
     matches.push({ rule: "private-key", index: found.index, text: found[0], what: "private key" })
   }
   for (const found of text.matchAll(CREDENTIAL_URL)) {
-    const user = found[1] ?? ""
-    const password = found[2] ?? ""
-    // @nifra-gate-reviewed: a password equal to its user name is a placeholder in the text being
-    // scanned; nothing is authenticated here.
-    if (PLACEHOLDER.test(password) || password === user || /[${}<>*]/.test(password)) continue
+    if (placeholderPassword(found[1] ?? "", found[2] ?? "")) continue
     matches.push({
       rule: "credential-url",
       index: found.index,
@@ -246,21 +293,146 @@ function formatMatches(text: string): Match[] {
   return matches
 }
 
+/** Words that mark a whole `_`/`-` segment of a value as a stand-in: `your_signing_secret`. */
+const PLACEHOLDER_SEGMENT =
+  /^(?:your|example|placeholder|sample|dummy|changeme|replace|generated|x{3,})$/
+
+const placeholderSegments = (value: string): boolean =>
+  value
+    .toLowerCase()
+    .split(/[_-]/)
+    .some((segment) => PLACEHOLDER_SEGMENT.test(segment))
+
+/** A word-cased label: letters and marks, hyphen-joined words, an acronym. No digits, no runs of
+ * mixed case, no credential punctuation. */
+const LABEL = /^(?:\p{Lu}{1,4}|\p{Lu}?[\p{Ll}\p{M}]+)(?:-(?:\p{Lu}{1,4}|\p{Lu}?[\p{Ll}\p{M}]+))*$/u
+
+/** How many string values a catalog holds at least, and the share of them that is prose. */
+const CATALOG_VALUES = 10
+
+/** Where a `/` starts a regular expression: after anything but a value's end. */
+const VALUE_END = /[\w$)\]}"'`]/
+
+/**
+ * The spans of top-level object literals that read as message catalogs: at least
+ * {@link CATALOG_VALUES} string property values, most of them prose with whitespace. A lexer, not a
+ * parser, so a build scans without TypeScript; strings, comments and regular expressions are skipped.
+ */
+function catalogSpans(text: string): Array<readonly [number, number]> {
+  const spans: Array<readonly [number, number]> = []
+  let depth = 0
+  let start = 0
+  let values = 0
+  let prose = 0
+  // Whether the open top-level brace starts an object literal, not a block such as a function body.
+  let literal = false
+  let last = ""
+  let i = 0
+  while (i < text.length) {
+    const c = text.charAt(i)
+    if (c === "/" && text[i + 1] === "/") {
+      const end = text.indexOf("\n", i)
+      i = end === -1 ? text.length : end
+      continue
+    }
+    if (c === "/" && text[i + 1] === "*") {
+      const end = text.indexOf("*/", i + 2)
+      i = end === -1 ? text.length : end + 2
+      continue
+    }
+    if (c === '"' || c === "'" || c === "`" || (c === "/" && !VALUE_END.test(last))) {
+      let j = i + 1
+      let inClass = false
+      for (; j < text.length; j++) {
+        const d = text[j]
+        if (d === "\\") {
+          j++
+          continue
+        }
+        if (c !== "`" && d === "\n") break
+        if (c !== "/") {
+          if (d === c) break
+          continue
+        }
+        if (d === "[") inClass = true
+        else if (d === "]") inClass = false
+        else if (d === "/" && !inClass) break
+      }
+      // A string after `:` is a property's value.
+      if (depth > 0 && c !== "/" && c !== "`" && last === ":") {
+        values++
+        if (/\s/.test(text.slice(i + 1, j))) prose++
+      }
+      last = c
+      i = j + 1
+      continue
+    }
+    if (c === "{") {
+      if (depth === 0) {
+        start = i
+        values = 0
+        prose = 0
+        const word = /([\w$]+)\s*$/.exec(text.slice(Math.max(0, i - 16), i))?.[1]
+        literal = last === "" || "=(,:[?".includes(last) || word === "default"
+      }
+      depth++
+    } else if (c === "}" && depth > 0 && --depth === 0) {
+      if (literal && values >= CATALOG_VALUES && prose * 2 > values) spans.push([start, i + 1])
+    }
+    if (!/\s/.test(c)) last = c
+    i++
+  }
+  return spans
+}
+
+/** The credential a literal given to `name` carries, when the name is secret-like and the literal
+ * looks random. */
+function credentialOf(name: string, value: string): string | undefined {
+  const key = name.toLowerCase().replace(/[-_]/g, "")
+  const header = AUTHORIZATION_NAME.test(key)
+  if (!header && !isSensitiveFieldName(name) && !EXTRA_SECRET_NAME.test(key)) return undefined
+  const secret = header ? authorizationCredential(value) : value
+  if (
+    secret === undefined ||
+    PUBLIC_VALUE.test(secret) ||
+    PLACEHOLDER.test(secret) ||
+    placeholderSegments(secret) ||
+    !looksRandom(secret, 16)
+  )
+    return undefined
+  return secret
+}
+
 function assignedMatches(text: string): Match[] {
   const matches: Match[] = []
-  for (const found of text.matchAll(ASSIGNED)) {
-    const name = found[1] ?? ""
-    if (!isSensitiveFieldName(name) && !EXTRA_SECRET_NAME.test(name.toLowerCase())) continue
-    if (!namesTheTarget(text, found.index, found[2] ?? "", found[3] ?? "")) continue
-    const value = found[4] ?? found[5] ?? found[6] ?? ""
-    if (PUBLIC_VALUE.test(value) || PLACEHOLDER.test(value) || !looksRandom(value, 16)) continue
+  let catalogs: ReadonlyArray<readonly [number, number]> | undefined
+  /** A label in a message catalog: `password: "Lykilorð"` names the field in another language. */
+  const catalogLabel = (value: string, valueAt: number): boolean => {
+    if (!LABEL.test(value)) return false
+    catalogs ??= catalogSpans(text)
+    return catalogs.some(([start, end]) => valueAt > start && valueAt < end)
+  }
+  const add = (name: string, value: string, valueAt: number): void => {
+    const secret = credentialOf(name, value)
+    if (secret === undefined || catalogLabel(value, valueAt)) return
     matches.push({
       rule: "assigned-secret",
-      index: found.index + found[0].indexOf(value),
-      text: value,
+      // The credential is the value's tail: a header value's scheme is not part of it.
+      index: valueAt + value.length - secret.length,
+      text: secret,
       what: `literal assigned to "${name}"`,
     })
   }
+  for (const found of text.matchAll(ASSIGNED)) {
+    if (!namesTheTarget(text, found.index, found[2] ?? "", found[3] ?? "")) continue
+    const value = found[4] ?? found[5] ?? found[6] ?? ""
+    add(found[1] ?? "", value, found.index + found[0].lastIndexOf(value))
+  }
+  for (const found of text.matchAll(PAIRED)) {
+    const value = found[3] ?? found[4] ?? found[5] ?? ""
+    if (NAME_LIKE.test(value) || !opensAPair(text, found.index, found[6] ?? "")) continue
+    add(found[2] ?? "", value, found.index + found[0].lastIndexOf(value))
+  }
   return matches
 }
 
@@ -508,7 +680,7 @@ export function createRedactor(
     for (const { what, pattern } of KEY_FORMATS) out = out.replace(pattern, `[redacted:${what}]`)
     out = out.replace(JWT, "[redacted:JWT]")
     out = out.replace(CREDENTIAL_URL, (match, user: string, password: string) =>
-      // @nifra-gate-reviewed: the same placeholder test as the scan; nothing is authenticated here.
+      // nifra-expect NF-S002: the same placeholder test as the scan; nothing is authenticated here.
       PLACEHOLDER.test(password) || password === user
         ? match
         : match.replace(`:${password}@`, ":[redacted]@"),

package/src/internal/server-boundary.ts

@@ -14,6 +14,7 @@
 export const SERVER_FN_MODULE = /\.fn(\.[cm]?[jt]sx?)?$/
 
 import { jsStringLiteral } from "./js-string.ts"
+import { DATE_TAG, REVIVE_DATES_SOURCE } from "./revive-dates.ts"
 
 // ---------------------------------------------------------------------------------------------------
 // `.fn` - turn a server-function module into the client stubs that call it.
@@ -50,15 +51,18 @@ const DECLARATION =
 const ANY_CALL = /\bserverFn\s*[<(]/g
 /** Strip line and block comments by forward index scan, so prose cannot register as code. Not a
  * regex: every regex shape for comment stripping either backtracks polynomially on adversarial
- * source or is opaque enough that reviewers cannot tell. A `//` preceded by `:` is kept (URL in a
- * string - the same heuristic the previous implementation used); an unterminated block comment
- * swallows the rest of the source, matching a real parser. */
+ * source or is opaque enough that reviewers cannot tell. String literals are stepped over, so a
+ * `"image/*"` cannot open a comment; a `//` preceded by `:` is kept (a URL outside a string); an
+ * unterminated block comment swallows the rest of the source, matching a real parser. */
 function stripComments(source: string): string {
   const parts: string[] = []
   let keepFrom = 0
   let i = 0
   while (i < source.length) {
-    if (source.startsWith("/*", i)) {
+    const char = source[i]
+    if (char === '"' || char === "'" || char === "`") {
+      i = stringEnd(source, i)
+    } else if (source.startsWith("/*", i)) {
       const close = source.indexOf("*/", i + 2)
       parts.push(source.slice(keepFrom, i))
       i = close === -1 ? source.length : close + 2
@@ -76,6 +80,21 @@ function stripComments(source: string): string {
   return parts.join("")
 }
 
+/** The index just past the string literal opening at `start`. A quote or apostrophe string also ends
+ * at a line break, so a stray one (JSX text, a regex literal) misreads one line at most. */
+function stringEnd(source: string, start: number): number {
+  const quote = source[start]
+  let i = start + 1
+  while (i < source.length) {
+    const char = source[i]
+    if (char === "\\") i += 2
+    else if (char === quote) return i + 1
+    else if (char === "\n" && quote !== "`") return i
+    else i++
+  }
+  return source.length
+}
+
 /**
  * The namespace a `*.fn.ts` module is mounted under: its filename without the `.fn` suffix.
  *
@@ -143,9 +162,14 @@ async function __nifraCall(name, input) {
     }
     throw new Error(\`[nifra/fn] \${name} failed: \${response.status}\${detail ? \` \${detail}\` : ""}\`)
   }
-  return response.status === 204 ? undefined : await response.json()
+  if (response.status === 204) return undefined
+  const text = await response.text()
+  const value = JSON.parse(text)
+  return text.includes('"${DATE_TAG}"') ? __nifraDates(value) : value
 }
 
+${REVIVE_DATES_SOURCE}
+
 ${calls}
 `
 }

package/src/internal/web-app.ts

@@ -1,3 +1,5 @@
+import { emitRequestErrorLog } from "@nifrajs/core/edge-kit"
+import { jsonLogger } from "@nifrajs/core/logger"
 import {
   type BackendEvidenceProvider,
   type BackendMount,
@@ -16,12 +18,15 @@ import { CACHE_CHANNEL } from "../isr.ts"
 import { generateLlmsTxt } from "../llms-txt.ts"
 import type { Manifest } from "../manifest.ts"
 import type { RenderAdapter } from "../render-seam.ts"
-import { PRERENDERED_LIST_PATH } from "../router.ts"
+import { createMatcher, PRERENDERED_LIST_PATH } from "../router.ts"
+import type { EvidenceAncestry } from "./evidence-traversal.ts"
 import { formatShadowedPages, shadowedPages } from "./mount-shadow.ts"
 import { createPageRequestExecutor, type NonceResolver } from "./page-execution.ts"
+import { requestPattern } from "./route-path.ts"
 
 export type { NonceResolver } from "./page-execution.ts"
 export interface CreateWebAppOptions<Env = unknown> {
+  readonly serverComponents?: import("../server-components/types.ts").ServerComponentRuntime
   readonly adapter: RenderAdapter
   readonly manifest: Manifest
   /** URL of the built client entry (module script) injected into every page. */
@@ -78,9 +83,10 @@ export interface CreateWebAppOptions<Env = unknown> {
    *
    * **Why the timing matters.** `beforeHandle`, `afterHandle`, `around`, `derive`/`decorate`, and
    * `onError` are snapshotted into each route AS IT IS DECLARED, and `createWebApp` declares every
-   * page (plus the `/*` catch-all) before it returns - so a caller's `app.use(…)` afterwards binds
-   * them to nothing, silently. `requestId()` is exactly that case: it is a `derive`, so applied late
-   * it leaves every page without `c.requestId`. Route assurance evidence is order-scoped the same
+   * page (plus the `/*` catch-all) before it returns - so a caller's `app.use(…)` afterwards would
+   * bind them to no page, and outside production it throws (`HOOK_AFTER_PAGES`). `requestId()` is
+   * exactly that case: it is a `derive`, so applied late it would leave every page without
+   * `c.requestId`. A `group()` is its own scope and stays allowed. Route assurance evidence is order-scoped the same
    * way, so a late `securityHeaders()` leaves the pages unable to PROVE the header to `nifra assure`
    * even though it does still set it.
    *
@@ -101,10 +107,11 @@ export interface CreateWebAppOptions<Env = unknown> {
    * per-route via `@nifrajs/client`'s `createRoutes`). Opaque to the core.
    *
    * **Auto-mount.** Every `inProcessClient(backend)` exposes the symbol-keyed platform-aware backend
-   * mount interface from `@nifrajs/core/mount`; `createWebApp` also serves that backend over HTTP at
-   * {@link apiPrefix} (default `/api`): a request whose pathname starts with the prefix is dispatched
-   * before page routing with the same `env`/`waitUntil` platform context, and the backend's `Response`
-   * is returned untouched. The mount runs in `nifra dev` too. Pass `apiPrefix: ""` to disable it.
+   * mount interface from `@nifrajs/core/mount`; given an {@link apiPrefix}, `createWebApp` also serves
+   * that backend over HTTP there: a request whose pathname starts with the prefix is dispatched before
+   * page routing with the same `env`/`waitUntil` platform context, and the backend's `Response` is
+   * returned untouched. The mount runs in `nifra dev` too. Without `apiPrefix` the backend is
+   * loader-only.
    *
    * **Request-scoped loader calls.** While a page renders, its loaders, actions and boundaries get a
    * `ctx.api` bound to that request's platform identity: a backend handler reached through it sees the
@@ -114,12 +121,12 @@ export interface CreateWebAppOptions<Env = unknown> {
    * does not lose it. Headers do NOT travel: the page request's `cookie` and `authorization` are never
    * copied, so a loader call is anonymous unless the loader passes headers on the call itself. */
   readonly api?: unknown
-  /** HTTP path prefix the {@link api} backend is auto-mounted at (default `"/api"`). A request whose
+  /** HTTP path prefix the {@link api} backend is mounted at, such as `"/api"`. A request whose
    * pathname is exactly the prefix or starts with `prefix + "/"` is dispatched to the backend before
    * page routing; the backend therefore defines its routes at the **full** path (`server().post("/api/
-   * sync", …)`), matching the in-process `inProcessClient` call sites. Set to `""` to disable the
-   * auto-mount entirely (the app serves pages only and `api` stays a loader-only `ctx.api`). Mounting
-   * is also a no-op when `api` does not expose the symbol mount.
+   * sync", …)`), matching the in-process `inProcessClient` call sites. Unset or `""`, nothing is
+   * mounted: the app serves pages only and `api` stays a loader-only `ctx.api`. Mounting is also a
+   * no-op when `api` does not expose the symbol mount.
    *
    * A page file under the prefix (`routes/api/report.tsx`) could never render - the backend answers
    * first and its 404 is final - so `createWebApp` throws, naming the file. The same holds for every
@@ -146,7 +153,8 @@ export interface CreateWebAppOptions<Env = unknown> {
    * Tried longest-path-first and BEFORE the `api` mount, so a mount at `/api/auth` wins over a backend
    * at `/api` no matter which was declared first. `stripPrefix` is the per-mount form of {@link apiStrip}:
    * leave it off to pass the full path through. `opaque` states why a mount whose routes nifra cannot
-   * read (better-auth's handler) is outside assurance; it is then listed as a known gap.
+   * read (better-auth's handler) is outside assurance; it is then listed as a known gap, with any
+   * routes it declares reported as declared.
    */
   readonly mounts?: ReadonlyArray<{
     readonly path: string
@@ -154,7 +162,7 @@ export interface CreateWebAppOptions<Env = unknown> {
     readonly stripPrefix?: boolean
     readonly priority?: number
     readonly fallbackOn?: 404
-    readonly opaque?: string
+    readonly opaque?: MountOptions<Env>["opaque"]
   }>
   /** Secret for **draft / preview mode** (see `enableDraft`). When set, a request carrying a valid
    * signed `__nifra_draft` cookie gets `ctx.draft === true` in loaders/actions (else always `false`).
@@ -191,8 +199,10 @@ export interface CreateWebAppOptions<Env = unknown> {
    * team - unreleased feature names, internal hostnames, and "don't touch X yet" notes live there
    * routinely. Turn it on only for a repo whose guidelines you would publish as a page. */
   readonly publishLocalGuidelines?: boolean
-  /** Serve `/llms.txt` and `/llms-full.txt` (default `true`): the page routes, and the backend routes
-   * when the backend is mounted over HTTP at {@link apiPrefix}. `false` registers neither path. */
+  /** Serve `/llms.txt` and `/llms-full.txt`: the page routes, and the backend routes when the backend
+   * is mounted over HTTP at {@link apiPrefix}, with their request and response schemas in the full
+   * text. **Off by default**: both are public and unauthenticated, and they list every route, admin
+   * and internal ones included. Turn it on for an app whose whole surface you would publish. */
   readonly llmsTxt?: boolean
   /** SSG: per dynamic route pattern, its `getStaticPaths` `fallback` (from `enumerateStaticRoutes` or
    * the build's `prerendered.json`). A route mapped to `"404"` rejects any path NOT in
@@ -204,8 +214,9 @@ export interface CreateWebAppOptions<Env = unknown> {
   readonly staticBoundaryCache?: import("../boundary.ts").StaticBoundaryCache
   /** Observe every loader/action failure - for error-reporting plugins (Sentry-style). Called for
    * real throws (not control-flow `Response`s like `redirect`), **before** the nearest `_error`
-   * boundary renders / a soft-nav 500 / a rethrow - so it sees errors that the boundary would
-   * otherwise hide. Observation only; its own throws are swallowed so a faulty reporter can't break
+   * boundary renders / a soft-nav 500 / a rethrow. A failure a boundary answers is also written to the
+   * server's `logger` (under its `errorLogDetail`) whether or not this is set, exactly as an unhandled
+   * error is. Observation only; its own throws are swallowed so a faulty reporter can't break
    * rendering. (`beforeLoader` is intentionally omitted - the core HTTP hooks already cover
    * pre-request work.) */
   readonly onLoaderError?: (
@@ -258,10 +269,14 @@ function backendMountOf<Env>(api: unknown): MountableApp<Env> | undefined {
   return mount
 }
 
-function evidenceProviderOf(value: unknown): BackendEvidenceProvider | undefined {
+/** A provider a web app composes: it also takes the chain of web providers above it, which a
+ * provider that composes nothing ignores. */
+type ComposedEvidenceProvider = (ancestry?: EvidenceAncestry) => ReturnType<BackendEvidenceProvider>
+
+function evidenceProviderOf(value: unknown): ComposedEvidenceProvider | undefined {
   if ((typeof value !== "object" && typeof value !== "function") || value === null) return undefined
   const provider = (value as { [NIFRA_BACKEND_EVIDENCE]?: unknown })[NIFRA_BACKEND_EVIDENCE]
-  return typeof provider === "function" ? (provider as BackendEvidenceProvider) : undefined
+  return typeof provider === "function" ? (provider as ComposedEvidenceProvider) : undefined
 }
 
 function mountPathPrefix(path: string): string {
@@ -274,6 +289,15 @@ function mountPathPrefix(path: string): string {
   return withoutWildcard.slice(0, end)
 }
 
+/** The server's own error log, for page failures an `_error` boundary answers before it sees them. */
+function boundaryErrorLog(
+  options: ServerOptions | undefined,
+): (error: unknown, request: Request) => void {
+  const logger = options?.logger ?? jsonLogger()
+  const detail = options?.errorLogDetail ?? "full"
+  return (error, request) => emitRequestErrorLog(logger, detail, error, { req: request })
+}
+
 /**
  * Build a nifra app from a route manifest: every route SSRs its layout chain via `renderPage`,
  * and a wildcard catch-all renders `_404` (or a plain 404). Reuses @nifrajs/core's router +
@@ -306,6 +330,38 @@ export function createWebApp<Env = unknown>(
   // `beforeHandle`, assurance evidence) actually bind to them - see the `use` option. A caller
   // cannot do this after the fact: by the time this function returns, the routes are declared.
   options.use?.(app)
+  if (options.serverComponents !== undefined) {
+    const runtime = options.serverComponents
+    const match = createMatcher(
+      manifest.routes
+        .filter((route) => runtime.owns(route.id))
+        .map((route) => ({ routeId: route.id, pattern: route.pattern })),
+    )
+    const privateRoute = (request: Request): boolean =>
+      request.headers.has("x-nifra-component") || match(new URL(request.url).pathname) !== undefined
+    Object.defineProperty(app, Symbol.for("nifra.web.private-route"), { value: privateRoute })
+    app.onResponse((response, request) => {
+      if (!privateRoute(request)) return response
+      const headers = new Headers(response.headers)
+      headers.set("cache-control", "private, no-store")
+      const vary = new Set(
+        (headers.get("vary") ?? "")
+          .split(",")
+          .map((name) => name.trim().toLowerCase())
+          .filter(Boolean),
+      )
+      vary.add("x-nifra-component")
+      vary.add("x-nifra-data")
+      headers.set("vary", [...vary].join(", "))
+      headers.delete("x-nifra-isr-revalidate")
+      headers.delete("x-nifra-isr-tags")
+      return new Response(response.body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers,
+      })
+    })
+  }
   // A resolver created by `createNonceResolver({ header })` carries a paired response hook. Register it
   // after caller middleware so its request-specific CSP value is the last default applied to a page.
   const nonceResponse = options.nonce?.onResponse
@@ -322,15 +378,15 @@ export function createWebApp<Env = unknown>(
       cacheChannel.enabled = true
     },
   })
-  // Auto-mount the in-process backend over HTTP at `apiPrefix` (default `/api`), BEFORE page routing.
+  // Mount the in-process backend over HTTP at `apiPrefix`, when one is given, BEFORE page routing.
   // Core's pre-route mount seam runs before the page wildcard `/*`; parent request hooks run first,
   // child request hooks run inside the mount, and parent response hooks still wrap the result.
   // The mount handles every HTTP method and preserves backend 404 responses instead of letting the
   // page catch-all render them. We dispatch the same `Request` object (its body unread), so
   // streamed/large bodies pass through untouched. The backend defines full prefixed paths
-  // (`server().post("/api/sync", …)`) unless `apiStrip` is enabled. `apiPrefix: ""` opts out;
-  // a non-mountable `api` remains loader-only and pages-only apps keep the no-mount fast path.
-  const apiPrefix = options.apiPrefix ?? "/api"
+  // (`server().post("/api/sync", …)`) unless `apiStrip` is enabled. Without a prefix, or with a
+  // non-mountable `api`, the backend is loader-only and pages-only apps keep the no-mount fast path.
+  const apiPrefix = options.apiPrefix ?? ""
   const apiStrip = options.apiStrip === true
   const mountedApi = backendMountOf<Env>(api)
   // Longest path first, so a more specific mount (`/api/auth`) is tried before a broader one (`/api`)
@@ -361,6 +417,22 @@ export function createWebApp<Env = unknown>(
     ? undefined
     : servedPrerenderedList(options.prerenderedPaths)
   const pageExecutor = createPageRequestExecutor<Env>({
+    ...(options.serverComponents === undefined
+      ? {}
+      : { serverComponents: options.serverComponents }),
+    ...(options.serverComponents === undefined
+      ? {}
+      : {
+          rerenderOwnerGET: async (
+            request: Request,
+            context: import("./page-execution.ts").PageRouteContext<Env>,
+          ) =>
+            app.fetch(request, {
+              env: context.env,
+              ...(context.waitUntil === undefined ? {} : { waitUntil: context.waitUntil }),
+              ...(context.clientIp === undefined ? {} : { clientIp: context.clientIp }),
+            }),
+        }),
     adapter,
     manifest,
     clientEntry,
@@ -384,18 +456,32 @@ export function createWebApp<Env = unknown>(
       ? {}
       : { nonce: cspNonceResolver(options.csp) as NonceResolver<Env>, csp: options.csp }),
     ...(options.onLoaderError === undefined ? {} : { onLoaderError: options.onLoaderError }),
+    logBoundaryError: boundaryErrorLog(options.server),
     cacheChannel,
   })
 
+  let ownsRootCatchAll = false
   for (const route of manifest.routes) {
-    app.register("GET", route.pattern, undefined, pageExecutor.get(route))
-    app.register("POST", route.pattern, undefined, pageExecutor.post(route))
+    const pattern = requestPattern(route.pattern)
+    if (pattern.startsWith("/*")) ownsRootCatchAll = true
+    app.register(
+      "GET",
+      pattern,
+      options.serverComponents?.owns(route.id)
+        ? { capabilities: options.serverComponents.capabilities(route.id) }
+        : undefined,
+      pageExecutor.get(route),
+    )
+    app.register("POST", pattern, undefined, pageExecutor.post(route))
   }
   // llms.txt & llms-full.txt describe what a visitor can reach: the pages, and the backend only when it
   // is served over HTTP - a backend the loaders call in-process has no public surface to describe. An
   // app route at either path takes precedence, and each text is built once per app.
-  if (options.llmsTxt !== false) {
-    const llmsOptions = { includeLocalGuidelines: options.publishLocalGuidelines === true }
+  if (options.llmsTxt === true) {
+    const llmsOptions = {
+      includeLocalGuidelines: options.publishLocalGuidelines === true,
+      apiPathPrefix: apiStrip ? mountPathPrefix(apiPrefix) : "",
+    }
     const publicApi = mountedApi !== undefined && apiPrefix !== "" ? api : undefined
     for (const [path, full] of [
       ["/llms.txt", false],
@@ -436,16 +522,13 @@ export function createWebApp<Env = unknown>(
   }
 
   // Wildcard catch-all: unmatched paths render the nearest `_404` (404), or a plain text 404 if
-  // absent.
-  app.register("GET", "/*", undefined, pageExecutor.fallback)
+  // absent. A root catch-all page (`[...slug].tsx`) already answers every path, the root included,
+  // and the router refuses a second `/*` under another param name.
+  if (!ownsRootCatchAll) app.register("GET", "/*", undefined, pageExecutor.fallback)
 
-  let evidenceComposing = false
-  const evidenceProvider: BackendEvidenceProvider = async () => {
-    if (evidenceComposing) {
-      throw new Error("[nifra/web] cyclic composed assurance evidence mount")
-    }
-    evidenceComposing = true
-    try {
+  const evidenceProvider: ComposedEvidenceProvider = async (passed) => {
+    const { traverseEvidence } = await import("./evidence-traversal.ts")
+    return traverseEvidence(evidenceProvider, passed, async (ancestry) => {
       const { composeProjectEvidence, snapshotProjectEvidence } = await import(
         "@nifrajs/core/evidence"
       )
@@ -464,7 +547,7 @@ export function createWebApp<Env = unknown>(
           )
         }
         parts.push({
-          evidence: await provider.call(mount.app),
+          evidence: await provider.call(mount.app, ancestry),
           ...(mount.stripPrefix === true ? { pathPrefix: mountPathPrefix(mount.path) } : {}),
         })
       }
@@ -476,14 +559,13 @@ export function createWebApp<Env = unknown>(
           )
         }
         parts.push({
-          evidence: await provider.call(api),
+          evidence: await provider.call(api, ancestry),
+          // biome-ignore lint/plugin/noConditionalEmptyObjectSpread: Evidence paths acquire a prefix only when the mounted backend strips it.
           ...(apiStrip ? { pathPrefix: mountPathPrefix(apiPrefix) } : {}),
         })
       }
       return composeProjectEvidence(parts)
-    } finally {
-      evidenceComposing = false
-    }
+    })
   }
   Object.defineProperty(app, NIFRA_BACKEND_EVIDENCE, {
     configurable: false,
@@ -491,6 +573,8 @@ export function createWebApp<Env = unknown>(
     value: evidenceProvider,
     writable: false,
   })
+  // Core's dev-time hook audit reads this: an order-scoped hook added from here on skips every page.
+  Object.defineProperty(app, Symbol.for("nifra.web.pagesDeclared"), { value: true })
 
   return app
 }